ci: publish npm via OIDC trusted publishing (drop NPM_TOKEN) #1247
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| jobs: | |
| check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Install Python deps for codegen | |
| run: python3 -m pip install pyyaml | |
| - name: Verify generated code is up to date | |
| run: | | |
| cp internal/api/types_gen.go /tmp/types_gen_committed.go | |
| cp internal/api/paths_gen.go /tmp/paths_gen_committed.go | |
| make gen | |
| for f in types_gen paths_gen; do | |
| if ! diff -q "internal/api/$f.go" "/tmp/${f}_committed.go" > /dev/null 2>&1; then | |
| echo "::error::internal/api/$f.go is out of date. Run 'make gen' and commit the result." | |
| diff "/tmp/${f}_committed.go" "internal/api/$f.go" || true | |
| exit 1 | |
| fi | |
| done | |
| - name: gofmt | |
| run: | | |
| out=$(gofmt -l ./internal ./cmd) | |
| if [ -n "$out" ]; then | |
| echo "::error::unformatted files:"; echo "$out"; exit 1 | |
| fi | |
| - name: vet | |
| run: go vet ./... | |
| - name: build | |
| run: go build ./... | |
| - name: test | |
| run: go test -race -coverprofile=coverage.out ./... | |
| - name: coverage report | |
| run: go tool cover -func=coverage.out | tail -1 | |
| - name: golangci-lint | |
| uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 | |
| with: | |
| version: v2.12.2 | |
| - name: govulncheck | |
| run: go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 ./... | |
| - name: dependency cooldown | |
| run: go list -m -json all | go run ./scripts/checkdepage | |
| darwin-build: | |
| runs-on: macos-14 | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Build with native Keychain support | |
| run: CGO_ENABLED=1 go build ./... | |
| - name: Test native macOS code | |
| run: CGO_ENABLED=1 go test ./... |